@molecule/app-bonds-default-react 2.0.0 → 3.0.0

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-24T08:39:00.105Z
+Generated: 2026-10-25T20:03:32.757Z
 -->
 
 # @molecule/app-bonds-default-react
@@ -113,7 +113,9 @@ this same wiring. Pass `stripApiPrefix: true` when the app uses
 when the API reads another scheme than `Bearer`: it is an option of THIS
 constructor (`createDefaultHttpClientWithAuthBearer({ authScheme: 'Token', … })`,
 or `createFetchClient({ baseURL, authScheme: 'Token' })` directly), never a
-property of the client it returns.
+property of the client it returns. The client is built with the same scheme, so
+a token the client also holds — the one a default auth bond's token sync gives
+it — is sent with that scheme too, not as `Bearer`.
 
 ```typescript
 function createDefaultHttpClientWithAuthBearer(opts: {
@@ -128,19 +130,16 @@ function createDefaultHttpClientWithAuthBearer(opts: {
 #### `createDefaultAuthClient(authConfig)`
 
 Builds the default JWT auth client + wires it into `@molecule/app-auth`.
-
-Replaces the 16-line per-app `bonds/auth-default.ts` that 93 fleet
-apps shipped byte-identically. Apps pass their own `authConfig`
-(which lives in `src/config.ts`).
+Apps pass their own `authConfig` (which lives in `src/config.ts`).
 
 `TUser` is the profile the app's pages read, and may be any JSON object type —
-including a profile with NO `id` (`{ username, email, bio, image }`), exactly
-like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
-type: nothing in the client reads it, and the fabricated value then travels into
-storage, `getUser()` and every page. Omit the type parameter and the default is
-`UserProfile`, whose `id: string` stays required — the profile is never inferred
-from `authConfig` (no member of it, and not from an annotated config variable),
-so an untyped wrapper call keeps the default contract.
+including a profile with NO `id` (`{ username, email, bio, image }`), as in the
+factory it wraps. Never add a synthetic `id` to satisfy a type: nothing in the
+client reads it, and the fabricated value then travels into storage, `getUser()`
+and every page. Omit the type parameter and the default is `UserProfile`, whose
+`id: string` stays required — the profile is never inferred from `authConfig`
+(not even from an annotated config variable), so an untyped wrapper call keeps
+the default contract.
 
 Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
 so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
@@ -151,8 +150,8 @@ argument — that is a 1.8 caller shape this major changes (see
 `AuthClientConfig`'s migration note in `@molecule/app-auth`).
 
 `TRegister` is the app's own registration fields (`{ username: string }` for a
-
-_(description truncated — read the full text in `node_modules/@molecule/app-bonds-default-react/dist/auth.d.ts`.)_
+RealWorld-shaped API), passed on to `@molecule/app-auth`'s factory so
+`authClient.register({ username, email, password })` type-checks with no cast.
 
 ```typescript
 function createDefaultAuthClient(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
@@ -164,26 +163,28 @@ function createDefaultAuthClient(authConfig: NoInfer<AuthClientConfigOptions<TUs
 #### `createDefaultAuthClientWithHttpSync(authConfig)`
 
 Variant of `createDefaultAuthClient` that also keeps the bonded
-`@molecule/app-http` client's bearer token in sync with auth events
-(login / register / refresh / logout). Required by apps whose http
-client must carry the JWT on every request — without this wiring,
-authed endpoints return 401 after page reloads or token refresh.
+`@molecule/app-http` client's bearer token in sync with the auth client's session.
+Required by apps whose http client must carry the JWT on every request — without
+this wiring, authed endpoints return 401 after page reloads or token refresh.
+
+The sync is a LIVE read: `@molecule/app-http`'s `setAuthTokenSource` registers the auth
+client's token, and every client the app bonds — one bonded after this setup too (the
+scaffold wires auth BEFORE http, so a token copied into the client present at setup was
+never sent) — reads it on each request. A session adopted with no
+auth event (`useAuth().setSession()`, an OAuth callback's `setAccessToken()`, the same
+profile under a new token) is therefore sent by the next request, not the previous
+account's bearer. A transport without `setAuthTokenResolver` is followed through a request
+interceptor (see `setAuthTokenSource` for which request first carries the change), and
+auth events still push the token to it.
+
+A cookie session (no body token) resolves to `null`, so the request carries NO
+`Authorization` header — a kept bearer would answer as the PRIOR session.
+Requests also wait for the session restore, so a page that fetches viewer data on mount
+cannot race it (see {@link registerAuthGate}).
 
 The profile type is `createDefaultAuthClient`'s: a JSON object type of named
 fields (see `AuthProfileShape`), including an app profile with no `id`.
 
-Hydrates the HTTP client's token from the persisted auth state
-on setup, then listens for auth events to keep them aligned, and holds
-requests until the session restore settles so a page effect that fetches
-viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
-
-The hydrated token is delivered through `@molecule/app-http`'s token source, not
-through a client read at setup: the scaffold wires auth BEFORE http, so a client
-read here is the unbonded fallback and the restored session's token would land on a
-client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
-with no `Authorization` header). The source is applied to the client WHENEVER it is
-bonded, so setup order no longer decides whether the first request is authorized.
-
 ```typescript
 function createDefaultAuthClientWithHttpSync(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
   authClient: AuthClient<TUser, TRegister>
@@ -196,15 +197,18 @@ function createDefaultAuthClientWithHttpSync(authConfig: NoInfer<AuthClientConfi
 Most aggressive variant — bonds a fetch-based HTTP client with the
 given `baseURL` (so molecule pkg `useGet('/path')` calls hit
 `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
-its bearer token in sync with auth events.
+its bearer token in sync with the auth client's session, read on every
+request: a session adopted with no auth event (`setSession()`,
+`setAccessToken()`) is sent by the next request. The token uses the auth
+config's `authScheme` (default `Bearer`); a client bonded after this setup
+gets the same source and auth events.
 
 The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
 render is the signed-in UI — do not gate a protected page (or a provider of
 yours) on a current-user request. This bond registers `whenRestored()` as the
 HTTP gate, so requests still wait for the background restore/verification to
 settle; only `useAuth().status === 'loading'` means "no decision yet"
-(xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
-on every navigation).
+(a page that waits on its own `/me` pays a round trip on every navigation).
 
 Used by apps where molecule packages render pricing / billing /
 other authed JSON-fetching screens that need both behaviors.
@@ -282,7 +286,7 @@ WITHOUT this, `createStore()` throws
 `@molecule/app-state: No provider set. Call setProvider() first` — nothing
 else in a scaffolded app wires the `state` bond, so the documented
 `createStore()` + `useStore()` pattern failed at the first render and every
-page came up blank while `tsc` passed (X1 flash-m65).
+page came up blank while `tsc` passed.
 
 ```typescript
 function setupAppStateSimple(): void
@@ -343,7 +347,7 @@ function setupAllDefaultBonds(): void
 
 Peer dependencies:
 
-- `@molecule/app-auth` ^2.0.0
+- `@molecule/app-auth` ^3.0.0
 - `@molecule/app-charts` ^1.0.1
 - `@molecule/app-charts-chartjs` ^1.0.1
 - `@molecule/app-client-search` ^1.0.0
@@ -356,7 +360,7 @@ Peer dependencies:
 - `@molecule/app-drag-drop-dndkit` ^1.0.1
 - `@molecule/app-fonts` ^1.0.1
 - `@molecule/app-fonts-arimo` ^1.0.1
-- `@molecule/app-http` ^1.0.1
+- `@molecule/app-http` ^1.5.0
 - `@molecule/app-icons` ^1.0.1
 - `@molecule/app-icons-molecule` ^1.0.1
 - `@molecule/app-keyboard-shortcuts` ^1.0.1

package/dist/auth.d.ts

@@ -30,7 +30,9 @@ export declare function createDefaultHttpClient(baseURL: string): {
  * when the API reads another scheme than `Bearer`: it is an option of THIS
  * constructor (`createDefaultHttpClientWithAuthBearer({ authScheme: 'Token', … })`,
  * or `createFetchClient({ baseURL, authScheme: 'Token' })` directly), never a
- * property of the client it returns.
+ * property of the client it returns. The client is built with the same scheme, so
+ * a token the client also holds — the one a default auth bond's token sync gives
+ * it — is sent with that scheme too, not as `Bearer`.
  */
 export declare function createDefaultHttpClientWithAuthBearer(opts: {
     baseURL: string;
@@ -51,19 +53,16 @@ export declare function createDefaultHttpClientWithAuthBearer(opts: {
 };
 /**
  * Builds the default JWT auth client + wires it into `@molecule/app-auth`.
- *
- * Replaces the 16-line per-app `bonds/auth-default.ts` that 93 fleet
- * apps shipped byte-identically. Apps pass their own `authConfig`
- * (which lives in `src/config.ts`).
+ * Apps pass their own `authConfig` (which lives in `src/config.ts`).
  *
  * `TUser` is the profile the app's pages read, and may be any JSON object type —
- * including a profile with NO `id` (`{ username, email, bio, image }`), exactly
- * like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
- * type: nothing in the client reads it, and the fabricated value then travels into
- * storage, `getUser()` and every page. Omit the type parameter and the default is
- * `UserProfile`, whose `id: string` stays required — the profile is never inferred
- * from `authConfig` (no member of it, and not from an annotated config variable),
- * so an untyped wrapper call keeps the default contract.
+ * including a profile with NO `id` (`{ username, email, bio, image }`), as in the
+ * factory it wraps. Never add a synthetic `id` to satisfy a type: nothing in the
+ * client reads it, and the fabricated value then travels into storage, `getUser()`
+ * and every page. Omit the type parameter and the default is `UserProfile`, whose
+ * `id: string` stays required — the profile is never inferred from `authConfig`
+ * (not even from an annotated config variable), so an untyped wrapper call keeps
+ * the default contract.
  *
  * Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
  * so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
@@ -93,25 +92,27 @@ export declare function createDefaultAuthClient<TUser extends AuthProfileConstra
 };
 /**
  * Variant of `createDefaultAuthClient` that also keeps the bonded
- * `@molecule/app-http` client's bearer token in sync with auth events
- * (login / register / refresh / logout). Required by apps whose http
- * client must carry the JWT on every request — without this wiring,
- * authed endpoints return 401 after page reloads or token refresh.
+ * `@molecule/app-http` client's bearer token in sync with the auth client's session.
+ * Required by apps whose http client must carry the JWT on every request — without
+ * this wiring, authed endpoints return 401 after page reloads or token refresh.
+ *
+ * The sync is a LIVE read: `@molecule/app-http`'s `setAuthTokenSource` registers the auth
+ * client's token, and every client the app bonds — one bonded after this setup too (the
+ * scaffold wires auth BEFORE http, so a token copied into the client present at setup was
+ * never sent) — reads it on each request. A session adopted with no
+ * auth event (`useAuth().setSession()`, an OAuth callback's `setAccessToken()`, the same
+ * profile under a new token) is therefore sent by the next request, not the previous
+ * account's bearer. A transport without `setAuthTokenResolver` is followed through a request
+ * interceptor (see `setAuthTokenSource` for which request first carries the change), and
+ * auth events still push the token to it.
+ *
+ * A cookie session (no body token) resolves to `null`, so the request carries NO
+ * `Authorization` header — a kept bearer would answer as the PRIOR session.
+ * Requests also wait for the session restore, so a page that fetches viewer data on mount
+ * cannot race it (see {@link registerAuthGate}).
  *
  * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
  * fields (see `AuthProfileShape`), including an app profile with no `id`.
- *
- * Hydrates the HTTP client's token from the persisted auth state
- * on setup, then listens for auth events to keep them aligned, and holds
- * requests until the session restore settles so a page effect that fetches
- * viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
- *
- * The hydrated token is delivered through `@molecule/app-http`'s token source, not
- * through a client read at setup: the scaffold wires auth BEFORE http, so a client
- * read here is the unbonded fallback and the restored session's token would land on a
- * client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
- * with no `Authorization` header). The source is applied to the client WHENEVER it is
- * bonded, so setup order no longer decides whether the first request is authorized.
  */
 export declare function createDefaultAuthClientWithHttpSync<TUser extends AuthProfileConstraint<TUser> = UserProfile, TRegister extends RegisterExtraShape<TRegister> = Record<never, never>>(authConfig: NoInfer<AuthClientConfigOptions<TUser>>): {
     authClient: AuthClient<TUser, TRegister>;
@@ -121,15 +122,18 @@ export declare function createDefaultAuthClientWithHttpSync<TUser extends AuthPr
  * Most aggressive variant — bonds a fetch-based HTTP client with the
  * given `baseURL` (so molecule pkg `useGet('/path')` calls hit
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
- * its bearer token in sync with auth events.
+ * its bearer token in sync with the auth client's session, read on every
+ * request: a session adopted with no auth event (`setSession()`,
+ * `setAccessToken()`) is sent by the next request. The token uses the auth
+ * config's `authScheme` (default `Bearer`); a client bonded after this setup
+ * gets the same source and auth events.
  *
  * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
  * render is the signed-in UI — do not gate a protected page (or a provider of
  * yours) on a current-user request. This bond registers `whenRestored()` as the
  * HTTP gate, so requests still wait for the background restore/verification to
  * settle; only `useAuth().status === 'loading'` means "no decision yet"
- * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
- * on every navigation).
+ * (a page that waits on its own `/me` pays a round trip on every navigation).
  *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EAEvB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAuCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA4BA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EACnD,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CA2BA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EAEvB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACZ,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAsCpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG;IACF,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAuBA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAMA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,GAClD;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAkCA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,SAAS,qBAAqB,CAAC,KAAK,CAAC,GAAG,WAAW,EACxD,SAAS,SAAS,kBAAkB,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAEtE,UAAU,EAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EACnD,kBAAkB,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACjE;IACD,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACxC,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B,CAmCA"}

package/dist/auth.js

@@ -7,9 +7,8 @@ import { createFetchClient, getClient as getHttpClient, setAuthGate, setAuthToke
  * flag, a feed, a `favorited` state) sends its request before `initialize()` has
  * restored the session, so it leaves with no `Authorization` header and the server
  * answers for an anonymous viewer. Localhost usually hides it — the restore wins
- * the race against the first effect there — and the deployed URL exposes it, which
- * is how X1 xr-molecule-flash-m95 spent ~25 min treating a "Follow" button on a
- * followed user as database leftovers.
+ * the race against the first effect there — and the deployed URL exposes it, where a
+ * "Follow" button on a followed user reads as stale database state.
  *
  * `whenRestored()` resolves immediately when no restore is in flight, so a request
  * made after boot never waits at all; it holds only while the restore is actually
@@ -62,13 +61,18 @@ export function createDefaultHttpClient(baseURL) {
  * when the API reads another scheme than `Bearer`: it is an option of THIS
  * constructor (`createDefaultHttpClientWithAuthBearer({ authScheme: 'Token', … })`,
  * or `createFetchClient({ baseURL, authScheme: 'Token' })` directly), never a
- * property of the client it returns.
+ * property of the client it returns. The client is built with the same scheme, so
+ * a token the client also holds — the one a default auth bond's token sync gives
+ * it — is sent with that scheme too, not as `Bearer`.
  */
 export function createDefaultHttpClientWithAuthBearer(opts) {
     const authScheme = opts.authScheme ?? 'Bearer';
     const httpClient = createFetchClient({
         baseURL: opts.baseURL,
         withCredentials: opts.withCredentials,
+        // The client's own token (a default auth bond's token sync) overrides the interceptor's
+        // header, so it must carry the same scheme.
+        authScheme,
     });
     httpClient.addRequestInterceptor((config) => {
         if (opts.stripApiPrefix && typeof config.url === 'string' && config.url.startsWith('/api/')) {
@@ -87,19 +91,16 @@ export function createDefaultHttpClientWithAuthBearer(opts) {
 }
 /**
  * Builds the default JWT auth client + wires it into `@molecule/app-auth`.
- *
- * Replaces the 16-line per-app `bonds/auth-default.ts` that 93 fleet
- * apps shipped byte-identically. Apps pass their own `authConfig`
- * (which lives in `src/config.ts`).
+ * Apps pass their own `authConfig` (which lives in `src/config.ts`).
  *
  * `TUser` is the profile the app's pages read, and may be any JSON object type —
- * including a profile with NO `id` (`{ username, email, bio, image }`), exactly
- * like the factory beneath this wrapper. Never add a synthetic `id` to satisfy a
- * type: nothing in the client reads it, and the fabricated value then travels into
- * storage, `getUser()` and every page. Omit the type parameter and the default is
- * `UserProfile`, whose `id: string` stays required — the profile is never inferred
- * from `authConfig` (no member of it, and not from an annotated config variable),
- * so an untyped wrapper call keeps the default contract.
+ * including a profile with NO `id` (`{ username, email, bio, image }`), as in the
+ * factory it wraps. Never add a synthetic `id` to satisfy a type: nothing in the
+ * client reads it, and the fabricated value then travels into storage, `getUser()`
+ * and every page. Omit the type parameter and the default is `UserProfile`, whose
+ * `id: string` stays required — the profile is never inferred from `authConfig`
+ * (not even from an annotated config variable), so an untyped wrapper call keeps
+ * the default contract.
  *
  * Type the config with the SAME type (`const authConfig: AuthClientConfig<MyUser> = { … }`)
  * so its `mapAuthResponse` is checked against `MyUser`, and name that type at the
@@ -132,25 +133,27 @@ export function createDefaultAuthClient(authConfig) {
 }
 /**
  * Variant of `createDefaultAuthClient` that also keeps the bonded
- * `@molecule/app-http` client's bearer token in sync with auth events
- * (login / register / refresh / logout). Required by apps whose http
- * client must carry the JWT on every request — without this wiring,
- * authed endpoints return 401 after page reloads or token refresh.
+ * `@molecule/app-http` client's bearer token in sync with the auth client's session.
+ * Required by apps whose http client must carry the JWT on every request — without
+ * this wiring, authed endpoints return 401 after page reloads or token refresh.
+ *
+ * The sync is a LIVE read: `@molecule/app-http`'s `setAuthTokenSource` registers the auth
+ * client's token, and every client the app bonds — one bonded after this setup too (the
+ * scaffold wires auth BEFORE http, so a token copied into the client present at setup was
+ * never sent) — reads it on each request. A session adopted with no
+ * auth event (`useAuth().setSession()`, an OAuth callback's `setAccessToken()`, the same
+ * profile under a new token) is therefore sent by the next request, not the previous
+ * account's bearer. A transport without `setAuthTokenResolver` is followed through a request
+ * interceptor (see `setAuthTokenSource` for which request first carries the change), and
+ * auth events still push the token to it.
+ *
+ * A cookie session (no body token) resolves to `null`, so the request carries NO
+ * `Authorization` header — a kept bearer would answer as the PRIOR session.
+ * Requests also wait for the session restore, so a page that fetches viewer data on mount
+ * cannot race it (see {@link registerAuthGate}).
  *
  * The profile type is `createDefaultAuthClient`'s: a JSON object type of named
  * fields (see `AuthProfileShape`), including an app profile with no `id`.
- *
- * Hydrates the HTTP client's token from the persisted auth state
- * on setup, then listens for auth events to keep them aligned, and holds
- * requests until the session restore settles so a page effect that fetches
- * viewer-dependent data on mount cannot race it (see {@link registerAuthGate}).
- *
- * The hydrated token is delivered through `@molecule/app-http`'s token source, not
- * through a client read at setup: the scaffold wires auth BEFORE http, so a client
- * read here is the unbonded fallback and the restored session's token would land on a
- * client nothing sends through (xr-molecule-flash-m156 — a reload sent every request
- * with no `Authorization` header). The source is applied to the client WHENEVER it is
- * bonded, so setup order no longer decides whether the first request is authorized.
  */
 export function createDefaultAuthClientWithHttpSync(authConfig) {
     const authClient = createJWTAuthClient(authConfig);
@@ -164,7 +167,9 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
             // Resolve the HTTP client per sync, never once here. `setClient` runs this
             // source, so the token reaches the client the scaffold bonds later as well as
             // one already bonded; a client kept from this moment would be the throwaway
-            // fallback the later `setHttpDefault()` replaces.
+            // fallback the later `setHttpDefault()` replaces. The client reads the source
+            // itself on every request, so a session adopted by `setSession()` (no auth
+            // event) or re-adopted for the same profile (no state change) is sent at once.
             setHttpAuthTokenSource(() => authClient.getAccessToken());
             authClient.addEventListener((event) => {
                 if (event.type === 'login' || event.type === 'register' || event.type === 'refresh') {
@@ -173,6 +178,10 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
                     // keeping a previously-set bearer here would pin the http client to the
                     // PRIOR session (e.g. a guest's) — the server prefers the Authorization
                     // header over the fresh cookie, so every request 401s as the old user.
+                    //
+                    // A client that implements `setAuthTokenResolver` already resolves the source
+                    // per request; this push is what carries the same change to a transport that
+                    // does not (and keeps `getAuthToken()` current there).
                     getHttpClient().setAuthToken(authClient.getAccessToken());
                 }
                 else if (event.type === 'logout') {
@@ -186,15 +195,18 @@ export function createDefaultAuthClientWithHttpSync(authConfig) {
  * Most aggressive variant — bonds a fetch-based HTTP client with the
  * given `baseURL` (so molecule pkg `useGet('/path')` calls hit
  * `${baseURL}/path` instead of the SPA's catch-all route), AND keeps
- * its bearer token in sync with auth events.
+ * its bearer token in sync with the auth client's session, read on every
+ * request: a session adopted with no auth event (`setSession()`,
+ * `setAccessToken()`) is sent by the next request. The token uses the auth
+ * config's `authScheme` (default `Bearer`); a client bonded after this setup
+ * gets the same source and auth events.
  *
  * The auth client restores a stored token AND user SYNCHRONOUSLY, so the first
  * render is the signed-in UI — do not gate a protected page (or a provider of
  * yours) on a current-user request. This bond registers `whenRestored()` as the
  * HTTP gate, so requests still wait for the background restore/verification to
  * settle; only `useAuth().status === 'loading'` means "no decision yet"
- * (xr-molecule-flash-m177: a page that waited on its own `/me` paid a round trip
- * on every navigation).
+ * (a page that waits on its own `/me` pays a round trip on every navigation).
  *
  * Used by apps where molecule packages render pricing / billing /
  * other authed JSON-fetching screens that need both behaviors.
@@ -214,22 +226,30 @@ export function createDefaultAuthClientWithFetchClient(authConfig, fetchClientOp
             const httpClient = createFetchClient({
                 baseURL: fetchClientOptions.baseURL,
                 withCredentials: fetchClientOptions.withCredentials ?? true,
+                // The scheme the auth config names for this token (`Authorization: Token <jwt>`).
+                authScheme: authConfig.authScheme,
             });
             // Registered BEFORE the bond: `setHttpClient` applies the restored session's
             // token, and the same source reaches any client an app bonds later instead of
-            // this one (xr-molecule-flash-m156 — a client captured at setup cannot).
+            // this one (xr-molecule-flash-m156 — a client captured at setup cannot). The
+            // client resolves the source on every request, so a session adopted by
+            // `setSession()` or `setAccessToken()` after this point is sent immediately.
             setHttpAuthTokenSource(() => authClient.getAccessToken());
             setHttpClient(httpClient);
             setClient(authClient);
             registerAuthGate(authClient);
             authClient.addEventListener((event) => {
+                // The client bonded NOW, resolved per event: an app that bonds its own client after
+                // this setup sends through that one, never through the client created above.
                 if (event.type === 'login' || event.type === 'register' || event.type === 'refresh') {
                     // Mirror the token exactly, including null — see the identical note in
                     // createDefaultAuthClientWithHttpSync (stale bearer = stuck prior session).
-                    httpClient.setAuthToken(authClient.getAccessToken());
+                    // The per-request read of the source above is the guarantee; this push keeps
+                    // `getAuthToken()` current on a transport without `setAuthTokenResolver`.
+                    getHttpClient().setAuthToken(authClient.getAccessToken());
                 }
                 else if (event.type === 'logout') {
-                    httpClient.setAuthToken(null);
+                    getHttpClient().setAuthToken(null);
                 }
             });
         },

package/dist/setup.d.ts

@@ -29,7 +29,7 @@ export declare function setupAppRoutingReactRouter(): void;
  * `@molecule/app-state: No provider set. Call setProvider() first` — nothing
  * else in a scaffolded app wires the `state` bond, so the documented
  * `createStore()` + `useStore()` pattern failed at the first render and every
- * page came up blank while `tsc` passed (X1 flash-m65).
+ * page came up blank while `tsc` passed.
  */
 export declare function setupAppStateSimple(): void;
 /** Wires `@molecule/app-storage-localstorage` to `@molecule/app-storage`. */

package/dist/setup.js

@@ -68,7 +68,7 @@ export function setupAppRoutingReactRouter() {
  * `@molecule/app-state: No provider set. Call setProvider() first` — nothing
  * else in a scaffolded app wires the `state` bond, so the documented
  * `createStore()` + `useStore()` pattern failed at the first render and every
- * page came up blank while `tsc` passed (X1 flash-m65).
+ * page came up blank while `tsc` passed.
  */
 export function setupAppStateSimple() {
     setState(defaultStateProvider);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/app-bonds-default-react",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Default app-side bond wirings for React+Tailwind+react-router+localStorage+Arimo font+molecule icons. 5 setup functions consolidating 665 byte-identical per-app bond wiring files across the fleet.",
   "homepage": "https://www.molecule.dev/packages/app-bonds-default-react",
   "type": "module",
@@ -9,7 +9,8 @@
   "scripts": {
     "build": "tsc",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "typecheck:tests": "tsc -p tsconfig.tests.json"
   },
   "exports": {
     ".": {
@@ -38,7 +39,7 @@
     "directory": "packages/app/infrastructure/bonds-default-react"
   },
   "devDependencies": {
-    "@molecule/app-auth": "2.0.0",
+    "@molecule/app-auth": "3.0.0",
     "@molecule/app-charts-chartjs": "1.0.3",
     "@molecule/app-client-search": "1.0.3",
     "@molecule/app-client-search-minisearch": "1.0.4",
@@ -50,7 +51,7 @@
     "@molecule/app-drag-drop-dndkit": "1.0.3",
     "@molecule/app-fonts": "1.2.2",
     "@molecule/app-fonts-arimo": "1.0.5",
-    "@molecule/app-http": "1.4.1",
+    "@molecule/app-http": "1.5.0",
     "@molecule/app-icons": "1.0.3",
     "@molecule/app-icons-molecule": "1.0.3",
     "@molecule/app-keyboard-shortcuts": "1.0.3",
@@ -59,7 +60,7 @@
     "@molecule/app-realtime": "1.0.4",
     "@molecule/app-realtime-socketio": "1.1.1",
     "@molecule/app-routing": "1.0.4",
-    "@molecule/app-routing-react-router": "1.1.1",
+    "@molecule/app-routing-react-router": "1.1.2",
     "@molecule/app-state": "1.0.4",
     "@molecule/app-storage": "1.0.4",
     "@molecule/app-storage-localstorage": "1.0.3",
@@ -80,7 +81,7 @@
     "vitest": "4.1.12"
   },
   "peerDependencies": {
-    "@molecule/app-auth": "^2.0.0",
+    "@molecule/app-auth": "^3.0.0",
     "@molecule/app-charts": "^1.0.1",
     "@molecule/app-charts-chartjs": "^1.0.1",
     "@molecule/app-client-search": "^1.0.0",
@@ -93,7 +94,7 @@
     "@molecule/app-drag-drop-dndkit": "^1.0.1",
     "@molecule/app-fonts": "^1.0.1",
     "@molecule/app-fonts-arimo": "^1.0.1",
-    "@molecule/app-http": "^1.0.1",
+    "@molecule/app-http": "^1.5.0",
     "@molecule/app-icons": "^1.0.1",
     "@molecule/app-icons-molecule": "^1.0.1",
     "@molecule/app-keyboard-shortcuts": "^1.0.1",